EUVD-2026-82934
GHSA-6f4p-h3xm-c8rc
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Remote unauthenticated low-complexity token that reliably yields a spoofed valid method (I:H, no C/A impact); AC:H and S:C are defensible since real smuggling needs a fronting proxy desync, but I align with the vendor's isolated-primitive rating.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
4DescriptionCVE.org
Summary
RtspMethods.valueOf() silently strips trailing control bytes (any character with code point <= 0x20, the full range that String.trim() removes) before performing a cache lookup against its ten pre-populated method constants. A wire-delivered RTSP request whose method token ends with a trailing control byte - for example PLAY\x00 or PLAY\r, immediately before the separating space - is decoded by RtspDecoder as a fully successful PLAY request, with decoderResult().isSuccess() true and request.method() RtspMethods.PLAY (same object reference as the cached singleton). The application layer cannot distinguish this from a clean PLAY request.
This is the same root cause as #16723 and #16971, in a sibling that those fixes did not reach. The fix for HttpMethod hardened HttpMethod.valueOf() directly, but RtspMethods.valueOf() has its own independent checkNonEmptyAfterTrim() call that runs before the cache lookup - meaning a trailing-control-byte token hits the cache before the hardened HttpMethod constructor ever sees it.
Reproduction
Minimal wire-level reproduction
Send the following raw bytes to any Netty-based RTSP server using R
AnalysisAI
Netty's codec-rtsp component silently normalizes away trailing control bytes in RTSP method tokens, so a wire request whose method token ends in a byte with code point <= 0x20 immediately before the separating space (for example PLAY\x00 or PLAY\r) is decoded as a fully successful PLAY request with decoderResult().isSuccess() == true and request.method() referencing the same cached singleton object, leaving the application layer unable to distinguish it from a clean PLAY. This is a remote, unauthenticated, low-complexity integrity flaw (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) affecting any product that embeds Netty and exposes an RTSP listener, including the Red Hat components named in the advisory such as AMQ Broker 7, AMQ Clients, Quarkus, Camel for Quarkus 3/Spring Boot 4, Keycloak, JBoss EAP 7/8, Single Sign-On 7, Data Grid 8, Fuse 7, Debezium 3, and Apicurio Registry 3. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a reachable RTSP endpoint served by Netty's codec-rtsp (RtspDecoder). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Vendor (Red Hat) CVSS 3.1 is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) - a remote, unauthenticated, low-complexity network flaw with pure integrity impact (C:N/A:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version was specified in the available intelligence for this CVE; Red Hat tracks the issue via https://access.redhat.com/security/cve/CVE-2026-93565 and https://bugzilla.redhat.com/show_bug.cgi?id=2536952, and affected users should monitor those pages for the fixed Netty codec-rtsp build and apply it once released, since the underlying correction belongs in RtspMethods.valueOf() (validation must occur before the cache lookup, matching the earlier HttpMethod hardening). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all RTSP listeners and deployments of Netty codec-rtsp and the listed Red Hat products (AMQ Broker 7, AMQ Clients, Quarkus, Camel for Quarkus 3/Spring Boot 4, Keycloak, JBoss EAP 7/8, Single Sign-On 7, Data Grid 8, Fuse 7, Debezium 3, and Apicurio Registry 3), identify internet-facing or untrusted-network exposures, and block or restrict public access to RTSP endpoints; within 7 days, deploy interim controls that reject RTSP method tokens containing trailing control bytes (code point <= 0x20) immediately before the separating space at the proxy, WAF, gateway, or application layer, validate that such controls make downstream behavior consistent, and increase monitoring for anomalous RTSP method usage; within 30 days, re-scan all affected assets, apply any vendor-released update as soon as it is available, and update secure configuration baselines and SDLC checks to enforce strict RTSP parsing, noting that no vendor-released patch identified at time of analysis for CVE-2026-93565.
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Build Of Keycloak
View allAccount takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Mismatched handling of the HTTP/1 absolute-form request authority in Red Hat build of Quarkus and other affected Red Hat
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Share
External POC / Exploit Code
Leaving vuln.today